| Mode | Name | Size | |
|---|---|---|---|
| -rw-r--r-- | .git-blame-ignore-revs | 213 | logstatsplainblame |
| d--------- | .githooks | 38 | logstatsplain |
| -rw-r--r-- | .gitignore | 455 | logstatsplainblame |
| -rw-r--r-- | CONTRIBUTING.md | 4862 | logstatsplainblame |
| -rw-r--r-- | LICENSE | 1079 | logstatsplainblame |
| -rw-r--r-- | README.md | 5675 | logstatsplainblame |
| -rw-r--r-- | TODO | 3734 | logstatsplainblame |
| -rw-r--r-- | TODO.new | 90 | logstatsplainblame |
| d--------- | docs | 290 | logstatsplain |
| d--------- | experiments | 919 | logstatsplain |
| -rwxr-xr-x | ida-tui | 827 | logstatsplainblame |
| d--------- | idatui | 1176 | logstatsplain |
| -rw-r--r-- | logo-trans.png | 224298 | logstatsplainblame |
| -rw-r--r-- | logo.ans | 40439 | logstatsplainblame |
| -rw-r--r-- | logo.png | 818833 | logstatsplainblame |
| -rw-r--r-- | pyproject.toml | 1126 | logstatsplainblame |
| -rw-r--r-- | ruff.toml | 1982 | logstatsplainblame |
| d--------- | tests | 1182 | logstatsplain |
| d--------- | tools | 122 | logstatsplain |
| -rw-r--r-- | uv.lock | 19884 | logstatsplainblame |
IDA Pro, right in your terminal.
Disassembly, decompiler and graphs, driven by the keyboard (the mouse works too).
disasm · pseudocode · graph · hex · strings · structs · traces · rpc
[!NOTE] This is a personal project and it changes often. There are no releases and no support promises, and things will sometimes break. You need your own licensed copy of IDA Pro. Feel free to poke around.
Why?
IDA's own interface is great, but it's a desktop app. ida-tui is for the times you'd rather stay in the terminal: working over SSH, sitting in a tmux pane next to your notes, or scripting your reverse engineering.
It doesn't replace IDA. IDA still does all the analysis. ida-tui just gives you a different window onto it.
Getting started
You'll need Python 3.11+ and IDA Pro 9.4+ (with idalib).
1. Install
uv sync
2. Optional: connect to IDA windows you already have open
uvx ida-hcli plugin install ida-nexus
3. Open a binary
./ida-tui /path/to/binary
If the binary is already open in IDA, ida-tui connects to that copy. If it isn't, ida-tui opens it in the background. Edits made in either place show up in the other, and quitting ida-tui never closes anyone else's session.
[!TIP] Raw firmware or other headerless files: tell IDA what it's looking at, or it will guess wrong:
sh ./ida-tui fw.bin --processor arm --base 0x8000000These settings only matter the first time a file is opened. On ARM,
tswitches between ARM and Thumb at the cursor, andTfinds Thumb code by reading the vector table.[!TIP] Binaries you can't write next to —
./ida-tui /bin/lswould need IDA to create/bin/ls.i64, which isn't yours to write. ida-tui notices before opening anything and offers to keep the database somewhere else instead (~/.local/share/idatui/db/, one stable path per binary, so your names and comments come back next time).--idb /path/to/db.i64picks the location yourself, and$IDATUI_DB_DIRmoves the default.
Keys
| Key | What it does |
|---|---|
enter / esc |
Follow a reference / go back |
tab or F5 |
Switch between disassembly and pseudocode |
space |
Graph view (z zoom · m minimap · J/K walk edges) |
s |
Split view: disassembly and pseudocode side by side |
g · / · ? |
Go to address · search · search backwards |
x · n · y · ; |
Cross-references · rename · change type · comment |
c · d · p · u · a |
Mark as code · data · function · undefined · string |
o · O · B |
Change number format · go back a format · show opcode bytes |
\ · " · ctrl+t |
Hex · strings · structs |
ctrl+n · ctrl+p |
Jump to a symbol · command palette |
ctrl+r · ctrl+s · ctrl+l · q |
Refresh · save · reload as… · quit |
F1 |
Show every key |
What's inside
| 📜 Disassembly | Code and data in one smooth scrolling view, in IDA's own colours. Huge binaries scroll just as easily as small ones. |
| 🧠 Pseudocode | Hex-Rays decompiler output with syntax highlighting. Anything you rename, retype or comment is saved back to IDA. |
| 🕸️ Graph | A proper control-flow graph with colour-coded arrows. Each box holds the same lines as the disassembly, so renaming and xrefs work inside it too. |
| 🪞 Split view | Disassembly and pseudocode side by side. Move through one and the other highlights the matching lines. |
| 🔎 Search | Search the whole database for text or byte patterns like 48 8b ?? c3. ida-tui works out which one you mean. |
| 🧱 Structs & types | Your types shown as plain C. Edit them and press ctrl+s to save them back into IDA. |
| 🔢 Number formats | Press o to cycle a number through hex, decimal, binary, character and offset. |
| 📝 Findings export | Press ctrl+e to write up your session as markdown: your names, comments and function signatures, grouped by function. |
| ⏱️ Execution traces | Load a Tenet trace and step backwards and forwards through time, with registers and stack shown at each step. |
| 🤖 Remote control | Let scripts or AI agents drive a running ida-tui. Handy for automation and livestreams. |
There's also a hex view, a strings list, projects with several binaries, and a splash screen that shows a real image in terminals that support it (kitty and friends).
Traces, remote control & demo mode
**Replay a trace.** Use `]` / `[` to step and `}` / `{` to step over calls:./ida-tui /path/to/binary --trace trace.0.log
./ida-tui /abs/path/bin --rpc /tmp/ida.sock
python -m idatui.drive pc main # show pseudocode for main
python -m idatui.drive rename sub_5BE0 foo # jump there and rename it
python tools/demo.py --spawn
Contributing
Bug reports and patches are welcome. CONTRIBUTING.md explains how ida-tui works under the hood and how to run the tests. The quick check needs only plain Python, no IDA:
python3 tests/run.py --fast